From fed660877c16562265327c6093ea645cf4176b5c Mon Sep 17 00:00:00 2001 From: Gerald Carter Date: Wed, 8 Jun 2005 22:10:34 +0000 Subject: r7415: * big change -- volker's new async winbindd from trunk (This used to be commit a0ac9a8ffd4af31a0ebc423b4acbb2f043d865b8) --- source3/nsswitch/winbindd_pam.c | 418 ++++++++++++++++++++++++++-------------- 1 file changed, 276 insertions(+), 142 deletions(-) (limited to 'source3/nsswitch/winbindd_pam.c') diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index 9061391118..97dc35c0e7 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -145,24 +145,99 @@ static NTSTATUS check_info3_in_group(TALLOC_CTX *mem_ctx, return NT_STATUS_LOGON_FAILURE; } +static struct winbindd_domain *find_auth_domain(const char *domain_name) +{ + struct winbindd_domain *domain; + + if (IS_DC) { + domain = find_domain_from_name_noinit(domain_name); + if (domain == NULL) { + DEBUG(3, ("Authentication for domain [%s] " + "as it is not a trusted domain\n", + domain_name)); + } + return domain; + } + + if (is_myname(domain_name)) { + DEBUG(3, ("Authentication for domain %s (local domain " + "to this server) not supported at this " + "stage\n", domain_name)); + return NULL; + } + + return find_our_domain(); +} + +static void set_auth_errors(struct winbindd_response *resp, NTSTATUS result) +{ + resp->data.auth.nt_status = NT_STATUS_V(result); + fstrcpy(resp->data.auth.nt_status_string, nt_errstr(result)); + + /* we might have given a more useful error above */ + if (*resp->data.auth.error_string == '\0') + fstrcpy(resp->data.auth.error_string, + get_friendly_nt_error_msg(result)); + resp->data.auth.pam_error = nt_status_to_pam(result); +} + /********************************************************************** Authenticate a user with a clear text password **********************************************************************/ -enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) +enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) +{ + struct winbindd_domain *domain; + fstring name_domain, name_user; + + /* Ensure null termination */ + state->request.data.auth.user + [sizeof(state->request.data.auth.user)-1]='\0'; + + /* Ensure null termination */ + state->request.data.auth.pass + [sizeof(state->request.data.auth.pass)-1]='\0'; + + DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid, + state->request.data.auth.user)); + + /* Parse domain and username */ + + parse_domain_user(state->request.data.auth.user, + name_domain, name_user); + + domain = find_auth_domain(name_domain); + + if (domain == NULL) { + set_auth_errors(&state->response, NT_STATUS_NO_SUCH_USER); + DEBUG(5, ("Plain text authentication for %s returned %s " + "(PAM: %d)\n", + state->request.data.auth.user, + state->response.data.auth.nt_status_string, + state->response.data.auth.pam_error)); + return WINBINDD_ERROR; + } + + async_domain_request(state->mem_ctx, domain, + &state->request, &state->response, + request_finished_cont, state); + return WINBINDD_PENDING; +} + +enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain, + struct winbindd_cli_state *state) { NTSTATUS result; fstring name_domain, name_user; - unsigned char trust_passwd[16]; - time_t last_change_time; - uint32 sec_channel_type; + const char *srv_name_slash; NET_USER_INFO_3 info3; - struct cli_state *cli = NULL; + unsigned char *session_key; + struct rpc_pipe_client *pipe_cli; uchar chal[8]; - TALLOC_CTX *mem_ctx = NULL; DATA_BLOB lm_resp; DATA_BLOB nt_resp; DOM_CRED ret_creds; + DOM_CRED *credentials; int attempts = 0; unsigned char local_lm_response[24]; unsigned char local_nt_response[24]; @@ -178,12 +253,6 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) DEBUG(3, ("[%5lu]: pam auth %s\n", (unsigned long)state->pid, state->request.data.auth.user)); - if (!(mem_ctx = talloc_init("winbind pam auth for %s", state->request.data.auth.user))) { - DEBUG(0, ("winbindd_pam_auth: could not talloc_init()!\n")); - result = NT_STATUS_NO_MEMORY; - goto done; - } - /* Parse domain and username */ parse_domain_user(state->request.data.auth.user, name_domain, name_user); @@ -197,7 +266,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) DATA_BLOB names_blob; DATA_BLOB nt_response; DATA_BLOB lm_response; - server_chal = data_blob_talloc(mem_ctx, chal, 8); + server_chal = data_blob_talloc(state->mem_ctx, chal, 8); /* note that the 'workgroup' here is a best guess - we don't know the server's domain at this point. The 'server name' is also @@ -218,8 +287,10 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) } data_blob_free(&names_blob); data_blob_free(&server_chal); - lm_resp = data_blob_talloc(mem_ctx, lm_response.data, lm_response.length); - nt_resp = data_blob_talloc(mem_ctx, nt_response.data, nt_response.length); + lm_resp = data_blob_talloc(state->mem_ctx, lm_response.data, + lm_response.length); + nt_resp = data_blob_talloc(state->mem_ctx, nt_response.data, + nt_response.length); data_blob_free(&lm_response); data_blob_free(&nt_response); @@ -228,7 +299,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) && SMBencrypt(state->request.data.auth.pass, chal, local_lm_response)) { - lm_resp = data_blob_talloc(mem_ctx, + lm_resp = data_blob_talloc(state->mem_ctx, local_lm_response, sizeof(local_lm_response)); } else { @@ -238,7 +309,7 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) chal, local_nt_response); - nt_resp = data_blob_talloc(mem_ctx, + nt_resp = data_blob_talloc(state->mem_ctx, local_nt_response, sizeof(local_nt_response)); } @@ -261,80 +332,95 @@ enum winbindd_result winbindd_pam_auth(struct winbindd_cli_state *state) goto done; } - if (!(contact_domain = find_our_domain())) { - DEBUG(1, ("Authentication for [%s] -> [%s]\\[%s] in our domain failed - we can't find our domain!\n", - state->request.data.auth.user, name_domain, name_user)); - result = NT_STATUS_NO_SUCH_USER; - goto done; - } + contact_domain = find_our_domain(); } - if ( !get_trust_pw(contact_domain->name, trust_passwd, &last_change_time, &sec_channel_type) ) { - result = NT_STATUS_CANT_ACCESS_DOMAIN_INFO; - goto done; + srv_name_slash = talloc_asprintf(state->mem_ctx, "\\\\%s", + contact_domain->dcname); + if (srv_name_slash == NULL) { + DEBUG(0, ("talloc_asprintf failed\n")); + return WINBINDD_ERROR; } - + /* check authentication loop */ do { + DOM_CRED clnt_creds; + ZERO_STRUCT(info3); ZERO_STRUCT(ret_creds); retry = False; - - /* Don't shut this down - it belongs to the connection cache code */ - result = cm_get_netlogon_cli(contact_domain, trust_passwd, - sec_channel_type, False, &cli); + + result = cm_connect_netlogon(contact_domain, state->mem_ctx, + &pipe_cli, &session_key, + &credentials); if (!NT_STATUS_IS_OK(result)) { DEBUG(3, ("could not open handle to NETLOGON pipe\n")); goto done; } - result = cli_netlogon_sam_network_logon(cli, mem_ctx, - &ret_creds, - name_user, name_domain, - global_myname(), chal, - lm_resp, nt_resp, - &info3); + credentials->timestamp.time = time(NULL); + memcpy(&clnt_creds, credentials, sizeof(clnt_creds)); + + /* Calculate the new credentials. */ + cred_create(session_key, &credentials->challenge, + clnt_creds.timestamp, &(clnt_creds.challenge)); + + result = rpccli_netlogon_sam_network_logon(pipe_cli, + state->mem_ctx, + srv_name_slash, + &clnt_creds, + &ret_creds, + name_user, + name_domain, + global_myname(), + chal, lm_resp, + nt_resp, &info3, + session_key); attempts += 1; - - /* We have to try a second time as cm_get_netlogon_cli + + /* We have to try a second time as cm_connect_netlogon might not yet have noticed that the DC has killed our connection. */ - if ( cli->fd == -1 ) { + if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) { retry = True; continue; - } + } - /* if we get access denied, a possible cuase was that we had and open - connection to the DC, but someone changed our machine account password - out from underneath us using 'net rpc changetrustpw' */ + /* if we get access denied, a possible cause was that we had + and open connection to the DC, but someone changed our + machine account password out from underneath us using 'net + rpc changetrustpw' */ - if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) ) { - DEBUG(3,("winbindd_pam_auth: sam_logon returned ACCESS_DENIED. Maybe the trust account " - "password was changed and we didn't know it. Killing connections to domain %s\n", + if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) { + DEBUG(3,("winbindd_pam_auth: sam_logon returned " + "ACCESS_DENIED. Maybe the trust account " + "password was changed and we didn't know it. " + "Killing connections to domain %s\n", name_domain)); - winbindd_cm_flush(); + invalidate_cm_connection(&contact_domain->conn); retry = True; - cli = NULL; } } while ( (attempts < 2) && retry ); - if (cli != NULL) { - /* We might have come out of the loop above with cli == NULL, - so don't dereference that. */ - clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); + if (NT_STATUS_IS_OK(result) && + (!clnt_deal_with_creds(session_key, credentials, + &ret_creds))) { + DEBUG(3, ("DC %s sent wrong credentials\n", + pipe_cli->cli->srv_name_slash)); + result = NT_STATUS_ACCESS_DENIED; } - + if (NT_STATUS_IS_OK(result)) { - netsamlogon_cache_store( cli->mem_ctx, name_user, &info3 ); + netsamlogon_cache_store(state->mem_ctx, name_user, &info3); wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3); /* Check if the user is in the right group */ - if (!NT_STATUS_IS_OK(result = check_info3_in_group(mem_ctx, &info3, state->request.data.auth.require_membership_of_sid))) { + if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3, state->request.data.auth.require_membership_of_sid))) { DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n", state->request.data.auth.user, state->request.data.auth.require_membership_of_sid)); @@ -407,9 +493,6 @@ done: SAFE_FREE(afsname); } - if (mem_ctx) - talloc_destroy(mem_ctx); - return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR; } @@ -417,15 +500,79 @@ done: Challenge Response Authentication Protocol **********************************************************************/ -enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) +enum winbindd_result winbindd_crap_auth(struct winbindd_cli_state *state) { + struct winbindd_domain *domain = NULL; + const char *domain_name = NULL; NTSTATUS result; - unsigned char trust_passwd[16]; - time_t last_change_time; - uint32 sec_channel_type; + + if (!state->privileged) { + char *error_string = NULL; + DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access " + "denied. !\n")); + DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions " + "on %s are set correctly.\n", + get_winbind_priv_pipe_dir())); + /* send a better message than ACCESS_DENIED */ + error_string = talloc_asprintf(state->mem_ctx, + "winbind client not authorized " + "to use winbindd_pam_auth_crap." + " Ensure permissions on %s " + "are set correctly.", + get_winbind_priv_pipe_dir()); + fstrcpy(state->response.data.auth.error_string, error_string); + result = NT_STATUS_ACCESS_DENIED; + goto done; + } + + /* Ensure null termination */ + state->request.data.auth_crap.user + [sizeof(state->request.data.auth_crap.user)-1]=0; + state->request.data.auth_crap.domain + [sizeof(state->request.data.auth_crap.domain)-1]=0; + + DEBUG(3, ("[%5lu]: pam auth crap domain: [%s] user: %s\n", + (unsigned long)state->pid, + state->request.data.auth_crap.domain, + state->request.data.auth_crap.user)); + + if (*state->request.data.auth_crap.domain != '\0') { + domain_name = state->request.data.auth_crap.domain; + } else if (lp_winbind_use_default_domain()) { + domain_name = lp_workgroup(); + } + + if (domain_name != NULL) + domain = find_auth_domain(domain_name); + + if (domain != NULL) { + async_domain_request(state->mem_ctx, domain, + &state->request, &state->response, + request_finished_cont, state); + return WINBINDD_PENDING; + } + + result = NT_STATUS_NO_SUCH_USER; + + done: + set_auth_errors(&state->response, result); + DEBUG(5, ("CRAP authentication for %s returned %s (PAM: %d)\n", + state->request.data.auth.user, + state->response.data.auth.nt_status_string, + state->response.data.auth.pam_error)); + return WINBINDD_ERROR; +} + + +enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain, + struct winbindd_cli_state *state) +{ + NTSTATUS result; + const char *srv_name_slash; NET_USER_INFO_3 info3; - struct cli_state *cli = NULL; - TALLOC_CTX *mem_ctx = NULL; + unsigned char *session_key; + struct rpc_pipe_client *pipe_cli; + DOM_CRED *credentials; const char *name_user = NULL; const char *name_domain = NULL; const char *workstation; @@ -436,30 +583,13 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) DATA_BLOB lm_resp, nt_resp; - if (!state->privileged) { - char *error_string = NULL; - DEBUG(2, ("winbindd_pam_auth_crap: non-privileged access denied. !\n")); - DEBUGADD(2, ("winbindd_pam_auth_crap: Ensure permissions on %s are set correctly.\n", - get_winbind_priv_pipe_dir())); - /* send a better message than ACCESS_DENIED */ - asprintf(&error_string, "winbind client not authorized to use winbindd_pam_auth_crap. Ensure permissions on %s are set correctly.", - get_winbind_priv_pipe_dir()); - fstrcpy(state->response.data.auth.error_string, error_string); - SAFE_FREE(error_string); - result = NT_STATUS_ACCESS_DENIED; - goto done; - } + /* This is child-only, so no check for privileged access is needed + anymore */ /* Ensure null termination */ state->request.data.auth_crap.user[sizeof(state->request.data.auth_crap.user)-1]=0; state->request.data.auth_crap.domain[sizeof(state->request.data.auth_crap.domain)-1]=0; - if (!(mem_ctx = talloc_init("winbind pam auth crap for %s", state->request.data.auth_crap.user))) { - DEBUG(0, ("winbindd_pam_auth_crap: could not talloc_init()!\n")); - result = NT_STATUS_NO_MEMORY; - goto done; - } - name_user = state->request.data.auth_crap.user; if (*state->request.data.auth_crap.domain) { @@ -491,8 +621,8 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) goto done; } - lm_resp = data_blob_talloc(mem_ctx, state->request.data.auth_crap.lm_resp, state->request.data.auth_crap.lm_resp_len); - nt_resp = data_blob_talloc(mem_ctx, state->request.data.auth_crap.nt_resp, state->request.data.auth_crap.nt_resp_len); + lm_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.lm_resp, state->request.data.auth_crap.lm_resp_len); + nt_resp = data_blob_talloc(state->mem_ctx, state->request.data.auth_crap.nt_resp, state->request.data.auth_crap.nt_resp_len); /* what domain should we contact? */ @@ -512,26 +642,25 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) goto done; } - if (!(contact_domain = find_our_domain())) { - DEBUG(1, ("Authenticatoin for [%s] -> [%s]\\[%s] in our domain failed - we can't find our domain!\n", - state->request.data.auth_crap.user, name_domain, name_user)); - result = NT_STATUS_NO_SUCH_USER; - goto done; - } - } - - if ( !get_trust_pw(contact_domain->name, trust_passwd, &last_change_time, &sec_channel_type) ) { - result = NT_STATUS_CANT_ACCESS_DOMAIN_INFO; - goto done; + contact_domain = find_our_domain(); } + srv_name_slash = talloc_asprintf(state->mem_ctx, "\\\\%s", + contact_domain->dcname); + if (srv_name_slash == NULL) { + DEBUG(0, ("talloc_asprintf failed\n")); + return WINBINDD_ERROR; + } + do { + DOM_CRED clnt_creds; ZERO_STRUCT(info3); ZERO_STRUCT(ret_creds); retry = False; - /* Don't shut this down - it belongs to the connection cache code */ - result = cm_get_netlogon_cli(contact_domain, trust_passwd, sec_channel_type, False, &cli); + result = cm_connect_netlogon(contact_domain, state->mem_ctx, + &pipe_cli, &session_key, + &credentials); if (!NT_STATUS_IS_OK(result)) { DEBUG(3, ("could not open handle to NETLOGON pipe (error: %s)\n", @@ -539,51 +668,66 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) goto done; } - result = cli_netlogon_sam_network_logon(cli, mem_ctx, - &ret_creds, - name_user, name_domain, - workstation, - state->request.data.auth_crap.chal, - lm_resp, nt_resp, - &info3); + credentials->timestamp.time = time(NULL); + memcpy(&clnt_creds, credentials, sizeof(clnt_creds)); + + /* Calculate the new credentials. */ + cred_create(session_key, &credentials->challenge, + clnt_creds.timestamp, &(clnt_creds.challenge)); + + result = rpccli_netlogon_sam_network_logon(pipe_cli, + state->mem_ctx, + srv_name_slash, + &clnt_creds, + &ret_creds, + name_user, + name_domain, + global_myname(), + state->request.data.auth_crap.chal, + lm_resp, + nt_resp, &info3, + session_key); attempts += 1; - /* We have to try a second time as cm_get_netlogon_cli + /* We have to try a second time as cm_connect_netlogon might not yet have noticed that the DC has killed our connection. */ - if ( cli->fd == -1 ) { + if (NT_STATUS_EQUAL(result, NT_STATUS_UNSUCCESSFUL)) { retry = True; continue; - } + } /* if we get access denied, a possible cause was that we had and open connection to the DC, but someone changed our machine account password out from underneath us using 'net rpc changetrustpw' */ - if ( NT_STATUS_V(result) == NT_STATUS_V(NT_STATUS_ACCESS_DENIED) ) { - DEBUG(3,("winbindd_pam_auth_crap: sam_logon returned ACCESS_DENIED. Maybe the trust account " - "password was changed and we didn't know it. Killing connections to domain %s\n", - contact_domain->name)); - winbindd_cm_flush(); + if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) { + DEBUG(3,("winbindd_pam_auth: sam_logon returned " + "ACCESS_DENIED. Maybe the trust account " + "password was changed and we didn't know it. " + "Killing connections to domain %s\n", + name_domain)); + invalidate_cm_connection(&contact_domain->conn); retry = True; - cli = NULL; } - + } while ( (attempts < 2) && retry ); - if (cli != NULL) { - /* We might have come out of the loop above with cli == NULL, - so don't dereference that. */ - clnt_deal_with_creds(cli->sess_key, &(cli->clnt_cred), &ret_creds); + if (NT_STATUS_IS_OK(result) && + (!clnt_deal_with_creds(session_key, credentials, + &ret_creds))) { + DEBUG(3, ("DC %s sent wrong credentials\n", + pipe_cli->cli->srv_name_slash)); + result = NT_STATUS_ACCESS_DENIED; } if (NT_STATUS_IS_OK(result)) { - netsamlogon_cache_store( cli->mem_ctx, name_user, &info3 ); + netsamlogon_cache_store( state->mem_ctx, name_user, &info3 ); wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3); - if (!NT_STATUS_IS_OK(result = check_info3_in_group(mem_ctx, &info3, state->request.data.auth_crap.require_membership_of_sid))) { + if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3, state->request.data.auth_crap.require_membership_of_sid))) { DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n", state->request.data.auth_crap.user, state->request.data.auth_crap.require_membership_of_sid)); @@ -591,19 +735,19 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state) } if (state->request.flags & WBFLAG_PAM_INFO3_NDR) { - result = append_info3_as_ndr(mem_ctx, state, &info3); + result = append_info3_as_ndr(state->mem_ctx, state, &info3); } else if (state->request.flags & WBFLAG_PAM_UNIX_NAME) { /* ntlm_auth should return the unix username, per 'winbind use default domain' settings and the like */ fstring username_out; const char *nt_username, *nt_domain; - if (!(nt_username = unistr2_tdup(mem_ctx, &(info3.uni_user_name)))) { + if (!(nt_username = unistr2_tdup(state->mem_ctx, &(info3.uni_user_name)))) { /* If the server didn't give us one, just use the one we sent them */ nt_username = name_user; } - if (!(nt_domain = unistr2_tdup(mem_ctx, &(info3.uni_logon_dom)))) { + if (!(nt_domain = unistr2_tdup(state->mem_ctx, &(info3.uni_logon_dom)))) { /* If the server didn't give us one, just use the one we sent them */ nt_domain = name_domain; } @@ -653,9 +797,6 @@ done: state->response.data.auth.nt_status_string, state->response.data.auth.pam_error)); - if (mem_ctx) - talloc_destroy(mem_ctx); - return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR; } @@ -666,20 +807,13 @@ enum winbindd_result winbindd_pam_chauthtok(struct winbindd_cli_state *state) NTSTATUS result; char *oldpass, *newpass; fstring domain, user; - CLI_POLICY_HND *hnd; - TALLOC_CTX *mem_ctx; + POLICY_HND dom_pol; struct winbindd_domain *contact_domain; + struct rpc_pipe_client *cli; DEBUG(3, ("[%5lu]: pam chauthtok %s\n", (unsigned long)state->pid, state->request.data.chauthtok.user)); - if (!(mem_ctx = talloc_init("winbind password change for %s", - state->request.data.chauthtok.user))) { - DEBUG(0, ("winbindd_pam_auth_crap: could not talloc_init()!\n")); - result = NT_STATUS_NO_MEMORY; - goto done; - } - /* Setup crap */ if (state == NULL) @@ -701,12 +835,15 @@ enum winbindd_result winbindd_pam_chauthtok(struct winbindd_cli_state *state) /* Get sam handle */ - if (!NT_STATUS_IS_OK(result = cm_get_sam_handle(contact_domain, &hnd)) ) { + result = cm_connect_sam(contact_domain, state->mem_ctx, &cli, + &dom_pol); + if (!NT_STATUS_IS_OK(result)) { DEBUG(1, ("could not get SAM handle on DC for %s\n", domain)); goto done; } - result = cli_samr_chgpasswd_user(hnd->cli, mem_ctx, user, newpass, oldpass); + result = rpccli_samr_chgpasswd_user(cli, state->mem_ctx, user, newpass, + oldpass); done: state->response.data.auth.nt_status = NT_STATUS_V(result); @@ -721,8 +858,5 @@ done: state->response.data.auth.nt_status_string, state->response.data.auth.pam_error)); - if (mem_ctx) - talloc_destroy(mem_ctx); - return NT_STATUS_IS_OK(result) ? WINBINDD_OK : WINBINDD_ERROR; } -- cgit